CVE

CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.

Severity

CRITICAL

CVSS

9.1

Published

Jan 31, 2022

Modified

Jun 17, 2026